@bleedingdev/modern-js-app-tools-extensions 3.9.0-ultramodern.9 → 3.9.3-ultramodern.10

package/dist/esm-node/build-config/internal-effect-discovery.mjs

@@ -0,0 +1,188 @@
+import "node:module";
+import { execFileSync } from "node:child_process";
+import { lstatSync, readFileSync, realpathSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+const EFFECT_TSGO_PACKAGE = '@effect/tsgo';
+const EFFECT_TSGO_BIN = 'effect-tsgo';
+const NATIVE_TYPESCRIPT_PACKAGES = [
+    "typescript",
+    "@typescript/native"
+];
+const EFFECT_TSRS_PROVIDER_VERSION = '0.59.0';
+const EFFECT_TSRS_TARGETS = new Set([
+    '@tsrs/darwin-arm64',
+    '@tsrs/linux-x64-gnu',
+    '@tsrs/linux-arm64-gnu'
+]);
+const failureStages = new WeakMap();
+const reportedUnsupportedTsrsTargets = new Set();
+function effectCompilerDiscoveryFailureStage(error) {
+    return error && 'object' == typeof error ? failureStages.get(error) : void 0;
+}
+function resolveEffectTsgoPackage(from) {
+    const projectRequire = createRequire(from);
+    const packageJsonPath = projectRequire.resolve(`${EFFECT_TSGO_PACKAGE}/package.json`);
+    const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf-8'));
+    const bin = 'string' == typeof packageJson.bin ? packageJson.bin : packageJson.bin?.[EFFECT_TSGO_BIN];
+    if (!bin) throw new Error(`Resolved ${EFFECT_TSGO_PACKAGE} package has no ${EFFECT_TSGO_BIN} bin: ${packageJsonPath}`);
+    const cliPath = realpathSync(resolve(dirname(packageJsonPath), bin));
+    if (!lstatSync(cliPath).isFile()) throw new Error(`Effect TS-Go CLI is not a regular file: ${cliPath}`);
+    return {
+        packageJsonPath,
+        packageJson,
+        cliPath
+    };
+}
+function isAbsentPackage(projectRequire, from, packageName, error) {
+    const filename = 'string' != typeof from || from.startsWith('file:') ? fileURLToPath(from) : from;
+    if (!(error instanceof Error) || !('code' in error) || 'MODULE_NOT_FOUND' !== error.code || 'path' in error && void 0 !== error.path || error.message.split('\n')[0] !== `Cannot find module '${packageName}/package.json'` || !('requireStack' in error) || !Array.isArray(error.requireStack) || error.requireStack[0] !== filename) return false;
+    for (const searchDirectory of projectRequire.resolve.paths(packageName) ?? [])try {
+        lstatSync(join(searchDirectory, packageName));
+        return false;
+    } catch (presenceError) {
+        if (!(presenceError instanceof Error) || !('code' in presenceError) || ![
+            'ENOENT',
+            'ENOTDIR'
+        ].includes(String(presenceError.code))) throw presenceError;
+    }
+    return true;
+}
+function resolveNativeTypeScriptPackage(from) {
+    const projectRequire = createRequire(from);
+    for (const packageName of NATIVE_TYPESCRIPT_PACKAGES){
+        let packageJsonPath;
+        try {
+            packageJsonPath = projectRequire.resolve(`${packageName}/package.json`);
+        } catch (error) {
+            if (isAbsentPackage(projectRequire, from, packageName, error)) continue;
+            throw error;
+        }
+        const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf-8'));
+        const major = packageJson.version?.match(/^(\d+)\.\d+\.\d+(?:[-+].*)?$/u)?.[1];
+        if (!major) throw new Error(`Resolved TypeScript package has no valid version: ${packageJsonPath}`);
+        if (Number(major) >= 7) return packageJsonPath;
+    }
+    throw new Error(`No native TypeScript backend is installed for ${String(from)}. Install typescript >=7 or @typescript/native.`);
+}
+function resolveNativeTypeScriptManifest(from) {
+    const packageJsonPath = resolveNativeTypeScriptPackage(from);
+    const directory = dirname(packageJsonPath);
+    const discoveryPackage = resolveNativeTypeScriptPackage(join(directory, '__ultramodern_effect_backend__.cjs'));
+    if (realpathSync(discoveryPackage) !== realpathSync(packageJsonPath)) throw new Error(`Effect discovery would select a different native TypeScript installation from ${directory}: ${discoveryPackage}`);
+    return packageJsonPath;
+}
+function readCompilerArtifact(filename) {
+    const canonicalPath = realpathSync(filename);
+    const stats = lstatSync(canonicalPath);
+    if (!stats.isFile()) throw new Error(`Compiler artifact is not a regular file: ${filename}`);
+    if (0 === stats.size) throw new Error(`Compiler artifact is empty: ${filename}`);
+    return canonicalPath;
+}
+function resolveTsrsManifest(from) {
+    const projectRequire = createRequire(from);
+    try {
+        return projectRequire.resolve('tsrs/package.json');
+    } catch (error) {
+        if (isAbsentPackage(projectRequire, from, 'tsrs', error)) return;
+        throw error;
+    }
+}
+function compilerVersion(compiler) {
+    return execFileSync(compiler, [
+        '--version'
+    ], {
+        encoding: 'utf8',
+        env: {
+            ...process.env,
+            TSRS_CHECKER_ASSIGNMENT: process.env.TSRS_CHECKER_ASSIGNMENT || 'go'
+        },
+        timeout: 10000,
+        maxBuffer: 1048576
+    }).trim();
+}
+function tsrsPlatform(manifestPath) {
+    const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+    const { getPlatformPackageName } = createRequire(manifestPath)(join(dirname(manifestPath), 'lib/platform.js'));
+    const nativeName = getPlatformPackageName();
+    const embedded = manifest.tsrs;
+    if ('string' != typeof nativeName || !nativeName || !manifest.optionalDependencies || 'object' != typeof manifest.optionalDependencies || Array.isArray(manifest.optionalDependencies) || 0 === Object.keys(manifest.optionalDependencies).length) throw new Error(`Invalid native tsrs capability metadata: ${manifestPath}`);
+    if ('string' != typeof manifest.name || !manifest.name || 'string' != typeof manifest.version || !/^\d+\.\d+\.\d+-ts[\w.-]+$/u.test(manifest.version) || 'string' != typeof embedded?.typescriptVersion || !/^7\.\d+\.\d+(?:[-+][\w.-]+)?$/u.test(embedded.typescriptVersion) || !manifest.version.endsWith(`-ts${embedded.typescriptVersion}`) || 'string' != typeof embedded.typescriptCommit || !/^[a-f\d]{40}$/u.test(embedded.typescriptCommit)) throw new Error(`Invalid native tsrs metadata: ${manifestPath}`);
+    const supported = Object.hasOwn(manifest.optionalDependencies, nativeName);
+    if (supported && manifest.optionalDependencies[nativeName] !== manifest.version) throw new Error(`Native tsrs target version does not match its selected package: ${manifestPath}`);
+    return {
+        manifest: manifest,
+        nativeName,
+        supported
+    };
+}
+function resolveTsrsCompiler(manifestPath, effect, configuredCompiler, configuredVersion) {
+    const { manifest } = tsrsPlatform(manifestPath);
+    const embedded = manifest.tsrs;
+    const effectName = `@effect/tsgo-${process.platform}-${process.arch}`;
+    const effectManifest = createRequire(effect.cliPath).resolve(`${effectName}/package.json`);
+    const platform = JSON.parse(readFileSync(effectManifest, 'utf8'));
+    const metadataPath = join(dirname(effectManifest), 'lib/upstream.json');
+    const metadata = JSON.parse(readFileSync(metadataPath, 'utf8'));
+    const component = metadata.components?.tsrs?.[manifest.version];
+    if (platform.name !== effectName || platform.version !== effect.packageJson.version || 5 !== metadata.schemaVersion || !/^[a-f\d]{40}$/u.test(component?.gitHead ?? '') || component?.typescript?.version !== embedded.typescriptVersion || component.typescript.gitHead !== embedded.typescriptCommit) throw new Error(`Effect replacement metadata does not match tsrs: ${metadataPath}`);
+    const compiler = readCompilerArtifact(configuredCompiler ?? join(dirname(effectManifest), 'artifacts/tsrs', manifest.version, 'win32' === process.platform ? 'tsrs.exe' : 'tsrs'));
+    const version = configuredVersion ?? compilerVersion(compiler);
+    const stamp = /\+effect-tsgo\.([\d.]+)\s+\(tsrs ([^,]+), microsoft\/TypeScript@([a-f\d]+)\)$/u.exec(version);
+    if (!stamp || stamp[1] !== effect.packageJson.version || stamp[2] !== manifest.version || stamp[3].length < 12 || !embedded.typescriptCommit.startsWith(stamp[3])) throw new Error(`Effect-enabled tsrs matching ${manifest.version} and @effect/tsgo@${effect.packageJson.version} is required: ${compiler}. Install matching packages or select a matching Effect-enabled candidate with EFFECT_TSGO_BIN.`);
+    return compiler;
+}
+function validateConfiguredEffectCompiler(compiler, from) {
+    const version = compilerVersion(compiler);
+    if (!/^Version \d+\.\d+\.\d+[\w.-]*\+effect-tsgo\.\d+\.\d+\.\d+(?:\s|$)/u.test(version)) throw new Error(`EFFECT_TSGO_BIN must select an Effect-enabled native compiler: ${compiler}`);
+    if (version.includes('(tsrs ')) {
+        const manifest = resolveTsrsManifest(from);
+        if (!manifest) throw new Error(`Cannot validate tsrs without its installed package metadata for ${String(from)}`);
+        resolveTsrsCompiler(manifest, resolveEffectTsgoPackage(from), compiler, version);
+    }
+}
+function resolveInstalledEffectCompiler(from) {
+    let stage = 'Package CLI resolution';
+    try {
+        const effect = resolveEffectTsgoPackage(from);
+        stage = 'Native tsrs package resolution';
+        const tsrsManifest = resolveTsrsManifest(from);
+        const tsrsTarget = tsrsManifest ? tsrsPlatform(tsrsManifest) : void 0;
+        if (tsrsTarget && effect.packageJson.version !== EFFECT_TSRS_PROVIDER_VERSION) throw new Error(`Unreviewed Effect tsrs capability contract: ${effect.packageJson.version}`);
+        const configuredTsrsCompiler = process.env.TSRS_BINARY || void 0;
+        if (tsrsManifest && tsrsTarget?.supported && (configuredTsrsCompiler || EFFECT_TSRS_TARGETS.has(tsrsTarget.nativeName))) {
+            stage = 'Native tsrs validation';
+            return resolveTsrsCompiler(tsrsManifest, effect, configuredTsrsCompiler);
+        }
+        if (tsrsTarget && !reportedUnsupportedTsrsTargets.has(tsrsTarget.nativeName)) {
+            reportedUnsupportedTsrsTargets.add(tsrsTarget.nativeName);
+            console.warn(`[UltraModern] ${tsrsTarget.supported ? `@effect/tsgo@${effect.packageJson.version} does not provide a tsrs replacement for ${tsrsTarget.nativeName}` : `tsrs does not declare ${tsrsTarget.nativeName}`}; selecting the Effect-enabled TypeScript-Go compiler.`);
+        }
+        stage = 'Native TypeScript package resolution';
+        const typeScriptManifest = resolveNativeTypeScriptManifest(from);
+        const typeScript = JSON.parse(readFileSync(typeScriptManifest, 'utf8'));
+        const nativeName = `@typescript/typescript-${process.platform}-${process.arch}`;
+        const nativeManifest = createRequire(typeScriptManifest).resolve(`${nativeName}/package.json`);
+        const native = JSON.parse(readFileSync(nativeManifest, 'utf8'));
+        if (native.name !== nativeName || native.version !== typeScript.version || 'string' != typeof native.version || !/^\d+\.\d+\.\d+(?:[-+][\w.-]+)?$/u.test(native.version) || 'string' != typeof native.gitHead || !/^[a-f\d]{40}$/u.test(native.gitHead) || native.gitHead !== typeScript.gitHead) throw new Error(`Native TypeScript platform does not match its selected package: ${nativeManifest}`);
+        const binaryName = 'win32' === process.platform ? 'tsc.exe' : 'tsc';
+        readCompilerArtifact(join(dirname(nativeManifest), 'lib', binaryName));
+        stage = 'Compiler backend lookup';
+        const effectName = `@effect/tsgo-${process.platform}-${process.arch}`;
+        const effectManifest = createRequire(effect.cliPath).resolve(`${effectName}/package.json`);
+        const platform = JSON.parse(readFileSync(effectManifest, 'utf8'));
+        if (platform.name !== effectName || 'string' != typeof effect.packageJson.version || platform.version !== effect.packageJson.version) throw new Error(`Effect platform does not match its selected provider: ${effectManifest}`);
+        const metadataPath = join(dirname(effectManifest), 'lib', 'upstream.json');
+        const metadata = JSON.parse(readFileSync(metadataPath, 'utf8'));
+        const component = metadata.components?.typescript?.[native.version];
+        const latestTypeScript = metadata.tags?.typescript?.latest;
+        if (5 !== metadata.schemaVersion || 'string' != typeof latestTypeScript || component?.provider !== "typescript-go" || component.gitHead !== native.gitHead) throw new Error(`Effect replacement metadata does not match the selected native TypeScript backend: ${metadataPath}`);
+        const compilerDirectory = native.version === latestTypeScript ? join(dirname(effectManifest), 'lib') : join(dirname(effectManifest), 'artifacts', "typescript", native.version);
+        return readCompilerArtifact(join(compilerDirectory, binaryName));
+    } catch (error) {
+        if (error && 'object' == typeof error && !failureStages.has(error)) failureStages.set(error, stage);
+        throw error;
+    }
+}
+export { effectCompilerDiscoveryFailureStage, resolveInstalledEffectCompiler, validateConfiguredEffectCompiler };

package/dist/esm-node/build-config/public.mjs

@@ -1,2 +1,2 @@
 import "node:module";
-export { getBuildConfigEnvironment, resolveEffectTsgoCompiler, withBuildConfigEnvironment } from "./build-environment.mjs";
+export { getBuildConfigEnvironment, resolveEffectTsgoCompiler } from "./build-environment.mjs";

package/dist/esm-node/build-config/remote-address.mjs

@@ -0,0 +1,21 @@
+import "node:module";
+import { resolveBrowserManifestAddress } from "@modern-js/surface-resolution";
+import { resolveDeployTarget } from "../deploy-output/target.mjs";
+import { getBuildConfigEnvironment } from "./build-environment.mjs";
+function createRemoteManifestUrl(options) {
+    const env = {
+        ...Object.fromEntries([
+            options.manifestEnv,
+            options.publicUrlEnv,
+            'ULTRAMODERN_CLOUDFLARE_WORKERS_DEV_SUBDOMAIN'
+        ].map((name)=>[
+                name,
+                getBuildConfigEnvironment(name)
+            ])),
+        MODERNJS_DEPLOY: resolveDeployTarget().target
+    };
+    const address = resolveBrowserManifestAddress(env, options, getBuildConfigEnvironment('NODE_ENV') ?? 'production');
+    if (!address.ok) throw new Error(`Remote ${options.mfName}: ${address.reason}`);
+    return env[options.manifestEnv]?.trim() || `${options.mfName}@${address.manifestUrl}`;
+}
+export { createRemoteManifestUrl };

package/dist/esm-node/cloudflare/artifacts.mjs

@@ -1,6 +1,7 @@
 import "node:module";
 import node_path from "node:path";
 import { fs } from "@modern-js/utils";
+import { CLOUDFLARE_PUBLIC_ASSET_SCOPE, normalizeDeclaredPublicAssets, stageDeclaredPublicAssets } from "../deploy-output/public-assets.mjs";
 import { RESERVED_ARTIFACT_DESTINATION_DIRECTORIES, RESERVED_ARTIFACT_DESTINATION_FILES, ROUTE_SPEC_OUTPUT } from "./constants.mjs";
 import { normalizeRelativePath } from "./utils.mjs";
 const normalizeCloudflareArtifact = (artifact, index)=>{
@@ -16,18 +17,7 @@ const normalizeCloudflareArtifact = (artifact, index)=>{
     };
 };
 const getCloudflareArtifacts = (modernConfig)=>(modernConfig.deploy?.worker?.artifacts ?? []).map(normalizeCloudflareArtifact);
-const normalizeCloudflarePublicAsset = (asset, index)=>{
-    const from = normalizeRelativePath(asset.from, `deploy.worker.publicAssets[${index}].from`, 'app root');
-    const to = normalizeRelativePath(asset.to, `deploy.worker.publicAssets[${index}].to`, 'Cloudflare public output', {
-        allowRoot: true
-    });
-    return {
-        from,
-        to,
-        index
-    };
-};
-const getCloudflarePublicAssets = (modernConfig)=>(modernConfig.deploy?.worker?.publicAssets ?? []).map(normalizeCloudflarePublicAsset);
+const getCloudflarePublicAssets = (modernConfig)=>normalizeDeclaredPublicAssets(modernConfig.deploy?.worker?.publicAssets, CLOUDFLARE_PUBLIC_ASSET_SCOPE);
 const copyCloudflareArtifacts = async (appDirectory, outputDirectory, artifacts)=>{
     for (const artifact of artifacts){
         const sourcePath = node_path.join(appDirectory, artifact.from);
@@ -35,13 +25,12 @@ const copyCloudflareArtifacts = async (appDirectory, outputDirectory, artifacts)
         await fs.copy(sourcePath, node_path.join(outputDirectory, artifact.to));
     }
 };
-const copyCloudflarePublicAssets = async (appDirectory, publicDirectory, publicAssets)=>{
-    for (const asset of publicAssets){
-        const sourcePath = node_path.join(appDirectory, asset.from);
-        if (!await fs.pathExists(sourcePath)) throw new Error(`deploy.worker.publicAssets[${asset.index}].from does not exist: ${asset.from}`);
-        await fs.copy(sourcePath, node_path.join(publicDirectory, asset.to));
-    }
-};
+const copyCloudflarePublicAssets = async (appDirectory, outputDirectory, publicAssets)=>stageDeclaredPublicAssets({
+        appDirectory,
+        outputDirectory,
+        assets: publicAssets,
+        scope: CLOUDFLARE_PUBLIC_ASSET_SCOPE
+    });
 const copyCloudflareD1Migrations = async (appDirectory, outputDirectory, modernConfig)=>{
     for (const [index, database] of (modernConfig.deploy?.worker?.d1Databases ?? []).entries()){
         if (!database.migrationsDir) continue;

package/dist/esm-node/cloudflare/delivery-unit.mjs

@@ -1,14 +1,22 @@
 import "node:module";
 import node_path from "node:path";
-import { ULTRAMODERN_BUILD_ARTIFACT_PATH, isUltramodernBuildArtifact, nonEmptyString, toDeliveryUnitIdentity } from "@modern-js/backend-federation-contracts";
+import { isDeepStrictEqual } from "node:util";
+import { ULTRAMODERN_BUILD_ARTIFACT_FILE, ULTRAMODERN_BUILD_ARTIFACT_PATH, assertRendererProfileCompatibility, assertUltramodernBuildArtifact, formatBackendFederationValidationErrors, immutableRendererRouterBindings, nonEmptyString, toDeliveryUnitIdentity, validateRendererIdentity, validateRendererProfile, validateRendererRouterBindings } from "@modern-js/backend-federation-contracts";
 import { fs } from "@modern-js/utils";
 import { resolveUltramodernReleaseIdentity } from "../release-identity.mjs";
 import { isRecord } from "./utils.mjs";
-const COMPACT_CONFIG_PATH = '.modernjs/ultramodern.json';
+const TOPOLOGY_PATH = 'topology/reference-topology.json';
+const RENDERER_PROJECTION_FIELDS = [
+    'renderer',
+    'rendererIdentity',
+    'rendererIdentities',
+    'rendererProfile',
+    'routerBindings'
+];
 const findWorkspaceRoot = async (appDirectory)=>{
     let current = node_path.resolve(appDirectory);
     for(;;){
-        if (await fs.pathExists(node_path.join(current, COMPACT_CONFIG_PATH))) return current;
+        if (await fs.pathExists(node_path.join(current, TOPOLOGY_PATH))) return current;
         const parent = node_path.dirname(current);
         if (parent === current) return;
         current = parent;
@@ -25,51 +33,83 @@ const stampReleaseIdentity = (identity, workspaceRoot)=>{
         })
     };
 };
-const resolveCompactApp = async (appDirectory)=>{
+const resolveTopologyApp = async (appDirectory)=>{
     const workspaceRoot = await findWorkspaceRoot(appDirectory);
     if (!workspaceRoot) return;
-    let compactConfig;
-    try {
-        compactConfig = await fs.readJSON(node_path.join(workspaceRoot, COMPACT_CONFIG_PATH));
-    } catch  {
-        return {
-            workspaceRoot
-        };
-    }
-    if (!isRecord(compactConfig)) return {
-        workspaceRoot
-    };
-    const topology = isRecord(compactConfig.topology) ? compactConfig.topology : void 0;
-    const apps = Array.isArray(topology?.apps) ? topology.apps : void 0;
-    if (!apps) return {
-        app: compactConfig,
-        workspaceRoot
-    };
+    const topology = await fs.readJSON(node_path.join(workspaceRoot, TOPOLOGY_PATH));
+    if (!isRecord(topology) || !isRecord(topology.shell) || !Array.isArray(topology.verticals) || void 0 !== topology.shells && !Array.isArray(topology.shells)) throw new Error('[cloudflare-delivery-unit] Invalid declared reference topology.');
+    const apps = [
+        topology.shell,
+        ...topology.verticals,
+        ...Array.isArray(topology.shells) ? topology.shells : []
+    ];
     const resolvedAppDirectory = node_path.resolve(appDirectory);
     const app = apps.find((candidate)=>{
         if (!isRecord(candidate)) return false;
         const appPath = nonEmptyString(candidate.path);
         return void 0 !== appPath && node_path.resolve(workspaceRoot, appPath.replace(/^\.\/+/u, '')) === resolvedAppDirectory;
     });
+    if (!isRecord(app)) throw new Error(`[cloudflare-delivery-unit] ${appDirectory} is missing from the declared reference topology.`);
     return {
-        ...isRecord(app) ? {
-            app
-        } : {},
+        app,
+        role: app === topology.shell || Array.isArray(topology.shells) && topology.shells.includes(app) ? 'shell' : 'microvertical',
         workspaceRoot
     };
 };
-const createDeliveryUnitStamp = (identity, app)=>{
-    const surfaceProfile = nonEmptyString(app?.surfaceProfile);
+const resolveTopologyReleaseRole = async (appDirectory)=>{
+    const resolved = await resolveTopologyApp(appDirectory);
+    if (!resolved?.app) return;
+    const kind = 'shell' === resolved.role ? 'shell' : 'vertical';
+    if (resolved.app.kind !== kind) throw new Error('[cloudflare-delivery-unit] Declared app kind disagrees with its topology membership.');
+    return resolved.role;
+};
+const createTopologyDeliveryUnitStamp = (identity, app)=>{
+    const surfaceProfile = nonEmptyString(app.surfaceProfile);
+    if (void 0 !== surfaceProfile && ![
+        'api-only',
+        'ui-only',
+        'full-stack'
+    ].includes(surfaceProfile)) throw new Error('[cloudflare-delivery-unit] Declared app has an invalid surface profile.');
     const emitsUi = 'api-only' !== surfaceProfile;
     const emitsApi = 'ui-only' !== surfaceProfile;
+    const appId = nonEmptyString(app.id);
+    if (!appId) throw new Error('[cloudflare-delivery-unit] Declared app requires an id.');
+    let ui;
+    if (emitsUi) if (RENDERER_PROJECTION_FIELDS.every((field)=>!Object.hasOwn(app, field))) ui = {
+        ...identity,
+        surface: 'ui'
+    };
+    else {
+        const routerBindings = isRecord(app.routerBindings) ? app.routerBindings : {};
+        const errors = [
+            ...validateRendererIdentity(app.rendererIdentity).errors,
+            ...validateRendererProfile(app.rendererProfile).errors,
+            ...validateRendererRouterBindings(app.routerBindings, Object.keys(routerBindings), 'routerBindings').errors
+        ];
+        if (errors.length) throw new Error(`[cloudflare-delivery-unit] ${formatBackendFederationValidationErrors(errors)}`);
+        const rendererIdentity = app.rendererIdentity;
+        const rendererProfile = app.rendererProfile;
+        if (!Object.hasOwn(routerBindings, rendererIdentity.entryName)) throw new Error('[cloudflare-delivery-unit] Topology routerBindings must include the primary renderer identity entry.');
+        const declaredIdentity = toDeliveryUnitIdentity(app.deliveryUnit);
+        if (rendererIdentity.renderer !== app.renderer || rendererIdentity.renderer !== rendererProfile.renderer || rendererIdentity.appId !== app.id || rendererIdentity.buildId !== declaredIdentity?.buildMarker) throw new Error('[cloudflare-delivery-unit] Topology UI renderer metadata must match its app and delivery-unit identity.');
+        ui = {
+            ...identity,
+            surface: 'ui',
+            rendererIdentity: {
+                ...rendererIdentity,
+                buildId: identity.buildMarker
+            },
+            rendererProfile,
+            routerBindings: immutableRendererRouterBindings(routerBindings)
+        };
+    }
+    else if (void 0 !== app.rendererIdentity || void 0 !== app.rendererProfile || void 0 !== app.routerBindings) throw new Error('[cloudflare-delivery-unit] API-only topology must not declare a UI renderer identity or profile.');
     return {
         ...identity,
+        appId,
         surfaces: {
-            ...emitsUi ? {
-                ui: {
-                    ...identity,
-                    surface: 'ui'
-                }
+            ...ui ? {
+                ui
             } : {},
             ...emitsApi ? {
                 api: {
@@ -81,22 +121,61 @@ const createDeliveryUnitStamp = (identity, app)=>{
     };
 };
 const resolveTopologyDeliveryUnit = async (appDirectory)=>{
-    const resolved = await resolveCompactApp(appDirectory);
+    const resolved = await resolveTopologyApp(appDirectory);
     if (!resolved?.app) return;
     const identity = toDeliveryUnitIdentity(resolved.app.deliveryUnit);
-    return identity ? createDeliveryUnitStamp(stampReleaseIdentity(identity, resolved.workspaceRoot), resolved.app) : void 0;
+    if (!identity) throw new Error('[cloudflare-delivery-unit] Declared app is missing a valid delivery-unit identity.');
+    return createTopologyDeliveryUnitStamp(stampReleaseIdentity(identity, resolved.workspaceRoot), resolved.app);
 };
-const resolveWorkerDeliveryUnitStamp = async (appDirectory)=>{
-    const buildArtifactPath = node_path.join(appDirectory, ULTRAMODERN_BUILD_ARTIFACT_PATH);
-    let identity;
-    if (await fs.pathExists(buildArtifactPath)) {
-        const artifact = await fs.readJSON(buildArtifactPath);
-        if (!isUltramodernBuildArtifact(artifact)) return;
-        identity = toDeliveryUnitIdentity(artifact.deliveryUnit);
+const resolveWorkerDeliveryUnitStamp = async (appDirectory, distDirectory)=>{
+    const buildArtifactPath = node_path.join(distDirectory, ULTRAMODERN_BUILD_ARTIFACT_FILE);
+    if (!await fs.pathExists(buildArtifactPath)) {
+        if (await fs.pathExists(node_path.join(appDirectory, ULTRAMODERN_BUILD_ARTIFACT_PATH))) throw new Error('[cloudflare-delivery-unit] Finalized build artifact is required before worker output stamping.');
+        return;
+    }
+    const artifact = await fs.readJSON(buildArtifactPath);
+    assertUltramodernBuildArtifact(artifact);
+    const identity = {
+        unitId: artifact.deliveryUnit.unitId,
+        buildMarker: artifact.deliveryUnit.buildMarker,
+        sourceRevision: artifact.deliveryUnit.sourceRevision
+    };
+    const resolved = await resolveTopologyApp(appDirectory);
+    const stampedArtifact = artifact;
+    let emitsApi = true;
+    if (resolved?.app) {
+        if (stampedArtifact.deliveryUnit.appId !== resolved.app.id) throw new Error('[cloudflare-delivery-unit] Build artifact appId must match the declared topology app.');
+        const declaredIdentity = toDeliveryUnitIdentity(resolved.app.deliveryUnit);
+        if (!declaredIdentity) throw new Error('[cloudflare-delivery-unit] Declared app is missing a valid delivery-unit identity.');
+        const expected = createTopologyDeliveryUnitStamp(identity, resolved.app);
+        for (const field of [
+            'unitId'
+        ])if (declaredIdentity[field] !== identity[field]) throw new Error(`[cloudflare-delivery-unit] Build artifact ${field} must match the declared topology delivery-unit identity.`);
+        const ui = stampedArtifact.surfaces.ui;
+        if (Boolean(expected.surfaces.ui) !== Boolean(ui)) throw new Error('[cloudflare-delivery-unit] Build artifact UI surface must match the declared topology surface profile.');
+        if (expected.surfaces.ui?.rendererIdentity && ui) {
+            if (!isDeepStrictEqual(expected.surfaces.ui.routerBindings, ui.routerBindings)) throw new Error('[cloudflare-delivery-unit] Finalized build routerBindings must match the declared topology router bindings.');
+            for (const field of [
+                'renderer',
+                'appId',
+                'entryName',
+                'protocolVersion',
+                'buildId'
+            ])if (expected.surfaces.ui.rendererIdentity[field] !== ui.rendererIdentity[field]) throw new Error(`[cloudflare-delivery-unit] Build artifact UI rendererIdentity.${field} must match the declared topology renderer identity.`);
+            assertRendererProfileCompatibility(expected.surfaces.ui.rendererProfile, ui.rendererProfile);
+        }
+        emitsApi = void 0 !== expected.surfaces.api;
     }
-    if (!identity) return;
-    const resolved = await resolveCompactApp(appDirectory);
-    if (resolved) identity = stampReleaseIdentity(identity, resolved.workspaceRoot);
-    return createDeliveryUnitStamp(identity, resolved?.app);
+    return {
+        ...stampedArtifact.deliveryUnit,
+        surfaces: {
+            ...emitsApi ? {
+                api: stampedArtifact.surfaces.api
+            } : {},
+            ...stampedArtifact.surfaces.ui ? {
+                ui: stampedArtifact.surfaces.ui
+            } : {}
+        }
+    };
 };
-export { resolveTopologyDeliveryUnit, resolveWorkerDeliveryUnitStamp };
+export { resolveTopologyDeliveryUnit, resolveTopologyReleaseRole, resolveWorkerDeliveryUnitStamp };

package/dist/esm-node/cloudflare/index.mjs

@@ -1,5 +1,6 @@
 import "node:module";
 import node_path from "node:path";
+import { BACKEND_FEDERATION_MANIFEST_FILE, BACKEND_FEDERATION_REMOTE_ENTRY_FILE, ULTRAMODERN_BUILD_ARTIFACT_FILE } from "@modern-js/backend-federation-contracts";
 import { fs } from "@modern-js/utils";
 import { createCloudflareOutputPlan } from "../cloudflare-output-plan.mjs";
 import { assertCloudflareOutput } from "../cloudflare-output-verifier/index.mjs";
@@ -7,7 +8,7 @@ import { readTemplate } from "../read-template.mjs";
 import { MICROVERTICAL_RELEASE_ENVELOPE_PATH, emitCloudflareStagedReleaseEnvelope, emitFrameworkMicroVerticalReleaseEnvelope, stageCloudflareReleaseEnvelope, verifyBuildOutputReleaseEnvelope, verifyCloudflareReleaseEnvelopeStaging } from "../release-envelope/framework-output.mjs";
 import { copyCloudflareArtifacts, copyCloudflareD1Migrations, copyCloudflarePublicAssets, getCloudflareArtifacts, getCloudflarePublicAssets } from "./artifacts.mjs";
 import { ROUTE_SPEC_FILE, ROUTE_SPEC_OUTPUT, WORKER_BUNDLE_DIRECTORY } from "./constants.mjs";
-import { resolveTopologyDeliveryUnit, resolveWorkerDeliveryUnitStamp } from "./delivery-unit.mjs";
+import { resolveWorkerDeliveryUnitStamp } from "./delivery-unit.mjs";
 import { createWorkerManifest, createWorkerModuleLoaders, getPublicAssetExcludes, shouldCopyToPublicAssets, shouldCopyToWorkerBundle } from "./worker-manifest.mjs";
 import { createWranglerConfig } from "./wrangler-config.mjs";
 const CLOUDFLARE_ENTRY_TEMPLATE_FRAGMENTS = [
@@ -32,20 +33,28 @@ const createCloudflarePreset = ({ api, appContext, modernConfig })=>{
     const publicAssetExcludes = getPublicAssetExcludes(appDirectory, modernConfig);
     const releaseEnvelopeEnabled = api.isPluginExists('@modern-js/ultramodern-release-envelope');
     let hasReleaseEnvelope = false;
+    let declaredPublicAssets = [];
     return {
         async prepare () {
             await fs.remove(outputDirectory);
         },
         async writeOutput () {
-            if (releaseEnvelopeEnabled && await fs.pathExists(node_path.join(distDirectory, MICROVERTICAL_RELEASE_ENVELOPE_PATH))) await emitFrameworkMicroVerticalReleaseEnvelope({
+            if (releaseEnvelopeEnabled) await emitFrameworkMicroVerticalReleaseEnvelope({
                 apiOnly,
+                appDirectory,
                 distDirectory,
+                role: modernConfig.deploy?.releaseEnvelopeRole,
                 target: 'cloudflare'
             });
             if (releaseEnvelopeEnabled) await verifyBuildOutputReleaseEnvelope(distDirectory, 'cloudflare');
             await fs.copy(distDirectory, publicDirectory, {
                 filter: (src)=>{
                     const relativePath = node_path.relative(distDirectory, src).replace(/\\/gu, '/');
+                    if (apiOnly && '' !== relativePath && ![
+                        BACKEND_FEDERATION_MANIFEST_FILE,
+                        BACKEND_FEDERATION_REMOTE_ENTRY_FILE,
+                        ULTRAMODERN_BUILD_ARTIFACT_FILE
+                    ].includes(relativePath)) return false;
                     return 'release' !== relativePath && !relativePath.startsWith('release/') && 'public' !== relativePath && !relativePath.startsWith('public/') && shouldCopyToPublicAssets(src, distDirectory, publicAssetExcludes);
                 }
             });
@@ -69,12 +78,12 @@ const createCloudflarePreset = ({ api, appContext, modernConfig })=>{
                 await fs.writeJSON(outputPlan.paths.workerPackage, outputPlan.packages.worker);
             }
             await copyCloudflareArtifacts(appDirectory, outputDirectory, cloudflareArtifacts);
-            await copyCloudflarePublicAssets(appDirectory, publicDirectory, getCloudflarePublicAssets(modernConfig));
+            declaredPublicAssets = await copyCloudflarePublicAssets(appDirectory, outputDirectory, getCloudflarePublicAssets(modernConfig));
             await copyCloudflareD1Migrations(appDirectory, outputDirectory, modernConfig);
             await fs.writeJSON(wranglerConfigPath, createWranglerConfig(appDirectory, modernConfig), {
                 spaces: 2
             });
-            const deliveryUnitStamp = await resolveWorkerDeliveryUnitStamp(appDirectory);
+            const deliveryUnitStamp = await resolveWorkerDeliveryUnitStamp(appDirectory, distDirectory);
             await fs.writeJSON(workerManifestPath, await createWorkerManifest(outputDirectory, modernConfig, appContext, deliveryUnitStamp), {
                 spaces: 2
             });
@@ -88,7 +97,7 @@ const createCloudflarePreset = ({ api, appContext, modernConfig })=>{
             const template = await readCloudflareEntryTemplate();
             const manifest = await fs.readJSON(workerManifestPath);
             await fs.writeFile(workerEntryPath, template.replace('p_workerManifest', JSON.stringify(manifest, null, 2)).replace('p_workerModuleLoaders', createWorkerModuleLoaders(manifest)));
-            const topologyDeliveryUnit = await resolveTopologyDeliveryUnit(appDirectory);
+            const topologyDeliveryUnit = await resolveWorkerDeliveryUnitStamp(appDirectory, distDirectory);
             await assertCloudflareOutput({
                 outputDirectory,
                 importWorker: false,
@@ -98,6 +107,7 @@ const createCloudflarePreset = ({ api, appContext, modernConfig })=>{
             });
             if (hasReleaseEnvelope) {
                 await emitCloudflareStagedReleaseEnvelope({
+                    declaredPublicAssets,
                     distDirectory,
                     outputDirectory
                 });

package/dist/esm-node/cloudflare/native-renderer.mjs

@@ -0,0 +1,49 @@
+import "node:module";
+import promises from "node:fs/promises";
+import node_path from "node:path";
+import { WORKER_BUNDLE_DIRECTORY } from "./constants.mjs";
+import { isRecord } from "./utils.mjs";
+const NATIVE_RENDERER_WORKER_RESOURCES_FILE = `${WORKER_BUNDLE_DIRECTORY}/native-renderer.json`;
+const invalid = (detail)=>new Error(`Invalid native renderer worker resources (${NATIVE_RENDERER_WORKER_RESOURCES_FILE}): ${detail}. Rebuild the application with deploy.worker.ssr before deploying.`);
+function validateEntry(entryName, value) {
+    if (!isRecord(value)) throw invalid(`entry ${entryName} is not an object`);
+    const { assets, hydrationBuildId, serverConfig, csrFallbackHeader, nonce } = value;
+    if (!Array.isArray(assets) || !assets.length) throw invalid(`entry ${entryName} has no document assets`);
+    if (void 0 !== hydrationBuildId && ('string' != typeof hydrationBuildId || !hydrationBuildId.trim())) throw invalid(`entry ${entryName} has an empty hydration build ID`);
+    if (!isRecord(serverConfig) || ![
+        true,
+        false,
+        'stream'
+    ].includes(serverConfig.ssr) || void 0 !== serverConfig.ssrByRouteIds && (!Array.isArray(serverConfig.ssrByRouteIds) || serverConfig.ssrByRouteIds.some((id)=>'string' != typeof id))) throw invalid(`entry ${entryName} has an invalid server config`);
+    for (const [field, text] of [
+        [
+            'csrFallbackHeader',
+            csrFallbackHeader
+        ],
+        [
+            'nonce',
+            nonce
+        ]
+    ])if (void 0 !== text && ('string' != typeof text || !text)) throw invalid(`entry ${entryName} has an invalid ${field}`);
+}
+async function readNativeRendererWorkerResources(distDirectory, build) {
+    let bytes;
+    try {
+        bytes = await promises.readFile(node_path.join(distDirectory, NATIVE_RENDERER_WORKER_RESOURCES_FILE), 'utf8');
+    } catch (error) {
+        if (error instanceof Error && 'code' in error && 'ENOENT' === error.code) return;
+        throw error;
+    }
+    const value = JSON.parse(bytes);
+    if (!isRecord(value) || 'ultramodern-native-worker-resources' !== value.schema || 1 !== value.version || 'string' != typeof value.renderer || !value.renderer || !isRecord(value.entries)) throw invalid('unknown schema');
+    if (value.renderer !== build?.renderer.name || !build.renderer.nativeDocuments) throw invalid(`renderer ${value.renderer} is not the built native-document renderer`);
+    const entries = value.entries;
+    const nativeEntries = Object.entries(build.identities).filter(([, identity])=>identity.renderer === value.renderer);
+    for (const [entryName] of nativeEntries)if (!Object.hasOwn(entries, entryName)) throw invalid(`entry ${entryName} is missing`);
+    for (const [entryName, entry] of Object.entries(entries)){
+        if (!nativeEntries.some(([name])=>name === entryName)) throw invalid(`entry ${entryName} has no built ${value.renderer} renderer identity`);
+        validateEntry(entryName, entry);
+    }
+    return value;
+}
+export { NATIVE_RENDERER_WORKER_RESOURCES_FILE, readNativeRendererWorkerResources };